VulnerabilityModified
CVE-2011-1088
Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application.
MEDIUM 5.8EPSS 6.45%
Does this matter?
Lower severity and a low EPSS score (6.45%). Track it; it rarely justifies an emergency change on its own.
Description
Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application.
- CVSS 2.0
- 5.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
- EPSS
- 6.45% probability · 93th percentile
- CISA KEV
- Not listed
- Affected
- apache/tomcat
- Source
- secalert@redhat.com
References
- http://mail-archives.apache.org/mod_mbox/www-announce/201103.mbox/%3C4D6E74FF.7050106%40apache.org%3E
- http://markmail.org/message/lzx5273wsgl5pob6
- http://markmail.org/message/yzmyn44f5aetmm2r
- http://secunia.com/advisories/43684Vendor Advisory
- http://svn.apache.org/viewvc?view=revision&revision=1076586Patch
- http://svn.apache.org/viewvc?view=revision&revision=1076587
- http://svn.apache.org/viewvc?view=revision&revision=1077995
- http://tomcat.apache.org/security-7.htmlVendor Advisory
- http://www.osvdb.org/71027
- http://www.securityfocus.com/archive/1/517013/100/0/threaded
- http://www.securityfocus.com/bid/46685
- http://www.securitytracker.com/id?1025215
- http://www.vupen.com/english/advisories/2011/0563Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/65971
- http://mail-archives.apache.org/mod_mbox/www-announce/201103.mbox/%3C4D6E74FF.7050106%40apache.org%3E
- http://markmail.org/message/lzx5273wsgl5pob6
- http://markmail.org/message/yzmyn44f5aetmm2r
- http://secunia.com/advisories/43684Vendor Advisory
- http://svn.apache.org/viewvc?view=revision&revision=1076586Patch
- http://svn.apache.org/viewvc?view=revision&revision=1076587
- http://svn.apache.org/viewvc?view=revision&revision=1077995
- http://tomcat.apache.org/security-7.htmlVendor Advisory
- http://www.osvdb.org/71027
- http://www.securityfocus.com/archive/1/517013/100/0/threaded
- http://www.securityfocus.com/bid/46685
- http://www.securitytracker.com/id?1025215
- http://www.vupen.com/english/advisories/2011/0563Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/65971
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.